8 ms·

A TPM holds a secret. It's useful for establishing identity, performing signing, etc. Think about the fact that an attacker on your system can take a session co

A TPM holds a secret. It's useful for establishing identity, performing signing, etc. Think about the fact that an attacker on your system can take a session cookie, move to another computer, and connect as you. A TPM can prevent this by establishing a cryptographic, hardware backed identity. This is a very significant win and critical to 'zero trust', which is now something the government is telling people to embrace. The whole thing with security is silly. They said it about UEFI - and yet I run Linux on UEFI systems all the time. I also have systems with TPMs that run Linux. Works fine. edit: People are downvoting you now, though I think your question is very reasonable and worth answering. Such is HN, though.

tehbeard 5y ago
...So my session cookie gets tied to a crypto key that (for all intents and purposes of what I've gleamed from the marketing speak, is burned into the TPM at the factory) is unique? I thought we were trying to get away from identifiable fingerprints? This seems like the most unique one you could get. I'm trying to learn about it, but all google wants to throw up these days is news articles on win11's requirement if it, marketing none-speak about "securing the platform" (which does to a layman, read similar to the other comments cry of lock-in), or dense whitepapers on threat models and cryptographic math.
- staticassertion 5y ago
  So, first off, the entire point of a session cookie is to uniquely identify you. Like, if you log into a website, it should be you, right? Second, you're close but just a bit off. While the TPM has a secret internally, it wouldn't expose that - it would be used to generate other secrets, or to sign things, basically it's sort of like putting a crypto library into your device so that you can perform cryptographic operations without knowing the secrets involved. But yes, there's a seed that gets soldered into the device itself. I use TPMs to ensure that no one can access our AWS environments from devices other than those we own, for example. I'm not really an expert on this sort of thing, though I do work in security professionally - hopefully I'm not butchering this. There are quite a few experts on the matter who comment on HN though, maybe one of them can speak more authoritatively on this. edit: Actually, I misread maybe - you aren't off. The session cookie is tied to the TPM - either existing within it, or requiring re-validation via the TPM.
  - Dylan16807 5y ago
    I don't want most session cookies to know I'm the same person from a previous cookie. And even if they know I'm the same person, I'd prefer they still not know whether the device I just logged in on is the same as a previous device. Separately from that, using the TPM to lock the session cookie to the device sounds useful.
    - staticassertion 5y ago
      I think we should differentiate a TPM backed cookie from, say, a tracking cookie. It isn't like an arbitrary website can track you with the TPM. TPMs aren't exposed to the web by any browser, at least to my knowledge - except through intermediary protocols provided by something like webauthn or an extension (Extended Verification, for example). Again, maybe someone more knowledgeable can explain more - I'm a consumer of TPMs, and I understand the concept, but I'm no expert.
      - Dylan16807 5y ago
        Well you can't secure normal cookies against extraction with a TPM, because you have to extract them to use them. So the question is how a particular protocol works, and whether a site can still identify you after you've deleted your session cookie. As far as I understand it, if you were wantonly using webauthn for all your session cookies, it would be relatively easy for a site to check if you're the same person as before.
        my123 5y ago
        > because you have to extract them to use them Nope, the thing is that you ask the TPM to sign something with the key/secret, but the TPM will not allow you by design to exfiltrate the secret.
        Dylan16807 5y ago
        Doing that would not be a normal cookie, which is my point.
- mjg59 5y ago
  No. Every TPM has a factory-supplied unique key called the endorsement key, but every other key on the TPM is randomly generated on the TPM. The keys you actively use /can/ be tied back to the endorsement key, but there's no need for them to be - for most cases, any cryptographic material you generate on the TPM will be indistinguishable from material you generate on the CPU, other than to the local client.
- eecc 5y ago
  It’s like having a Yubi key soldered into your machine. Each identity you want to protect has its own key (so its’s not necessarily de-anonymizing) with physical access - pin, biometric verification - required for use. It’s potentially very useful, although I 100% expect it to be backdoored by every geopolitical block.
hvdijk 5y ago
> They said it about UEFI - and yet I run Linux on UEFI systems all the time. Not just any UEFI, UEFI with SecureBoot enabled specifically. On SecureBoot-enabled systems, you're booting a Microsoft-signed executable that chainloads Grub, which then loads Linux. This has given Microsoft a power they should not have: the power to refuse to sign future versions of that first executable.
- martinflack 5y ago
  FWIW, you can setup your machine to boot using your keys rather than Microsoft keys: https://www.dannyvanheumen.nl/post/secure-boot-in-fedora/ https://www.dannyvanheumen.nl/post/secure-boot-in-fedora/
- eecc 5y ago
  Uhm, but on my Thinkpad I have to add keys to load Linux in trusted mode (installer asks to choose a password to lock these keys in order to establish their legitimacy when rebooting.) Also Ventoy needs to install user-defined keys into UEFI to make it work with Secure Boot. So my assumption is that - at least on Thinkpads - you can add your own user-defined keys; the only Caudine Fork where a Microsoft blessed loader might be involved is the one used by the distro installer. Or am I missing something
  - michaelmrose 5y ago
    When this was first discussed in the early 2000s the very legitimate worry was that it would be introduced as optional and gradually become mandatory terminating in machines where the user had as little control over the hardware/software as a game console. There is no reason to believe that this wasn't implemented thus far because of the high ethical standards Microsoft folks have historically adhered to and while we are to believe Microsoft has turned over a new leaf much of the current leadership was involved at the executive level in old bad Microsoft.
- vladvasiliu 5y ago
  As others have said, this is either FUD or limited to specific systems with broken UEFI implementations. I think the whole "MS-signed Grub" is a way by Ubuntu (and possibly others) to facilitate Linux installation by "non pros". And it's not that bad, I think. I, personally, use Arch Linux and the installer isn't signed with anything. They have a "do your own signing" policy. I had to disable SecureBoot to install it, because I couldn't be bothered to create a new ISO, but then I registered my own keys to the UEFI and boot directly my own signed kernel [0], without using GRUB at all. I did all this on multiple generation HP "enterprise" laptops and desktops and it worked without any issue. And those systems don't come with any sort of Linux support from HP. --- [0] For the curious, this is EFISTUB combined with sbsign, that bundles the kernel image, initrd and CPU microcode in a single EFI binary and signs it. This is then booted directly by the UEFI, and you can even register multiple binaries and have them show up in the UEFI boot selection menu.
rodgerd 5y ago
> Such is HN, though. A great many people who don't know as much about security or have a rational approach to threat modelling, alas.
userbinator 5y ago
The problem is that the TPM holds a secret that even the user cannot access despite being the owner. This is a very significant win and critical to 'zero trust', which is now something the government is telling people to embrace. If the government is really saying the equivalent of "trust us, but not the people you usually trust", that should a huge warning sign. The analogies to 1984 are disturbingly close.
- staticassertion 5y ago
  > The problem is that the TPM holds a secret that even the user cannot access despite being the owner. Why is this a problem? > If the government is really saying the equivalent of "trust us, but not the people you usually trust", I don't understand what you're talking about here. There is no additional trust necessary.
  - michaelmrose 5y ago
    Let's say you don't want users to view foobar.com so you convince Microsoft to configure it's browser not to resolve foobar.com. No problem the users install their own browser. Now we ask Microsoft to limit software that is signed by it effectively granted permission to run some software but not others. The alternatively browser is right out. The user installs his own OS now we ask Dell to only allow it's computers to boot software that implements the same restrictions as Microsoft has agreed to. So the user gets his own computer. Now we simply ask your bank or better yet your ISP not to connect to "insecure" devices that don't follow the standards described. Now you need a substantial unlatched vulnerability to be able to resolve foobar.com At it's root to make a users own device effectively restrict what they are allowed to do you need something difficult to defeat that you control and they do not. At one point a us senator wanted this used to allow music labels to remotely destroy users computers if they believed that you were pirating music and every other restriction described has been implemented or discussed using on user devices belonging to users and most implemented.
    - staticassertion 5y ago
      You can access TPMs on Linux just fine so this entire "but then what if" chain kinda makes no sense. A TPM restricts nothing on its own, it's just a hardware crypto token. I mean sure, if Microsoft decided that it wanted to do all of the things you said, and could convince all of the OEMs to help, and a bunch of services and ISPs or whatever, yes, that would suck. It's a totally fabricated hypothetical that would never play out, but sure.
VMtest 5y ago
Does the TPM or Microsoft's Pluton on the AMD/Intel CPU prevents people to use Linux? I know some Linux distros already supporting enabled Secure Boot edit: sorry I reread your comment that you already mentioned Linux can run with TPM
- michaelmrose 5y ago
  The point is that the TPM is an essential element of a set of standards called trusted computing that includes secure boot and more. It's not that secure boot nor the TPM in any fashion keeps Linux from inherently working. It's that it enables the OEM to decide what software is allowed to boot on the computer and enforce this. Microsoft typically gives OEMs a substantial break and the OEMs in turn sell most SKUs to 99% windows users and make only a small margin on those devices. A small discount on the cost of windows could make devices disproportionately more profitable and MS might be apt to see a percentage in offering such a discount to help lock out the competition. They have in fact over the years engaged in far more unethical behavior including investing tens of millions in a "partner's" fraudulent lawsuit/pump and dump scheme against various Linux vendors bankrolling an entire list of felonies.

tehbeard 5y ago

...So my session cookie gets tied to a crypto key that (for all intents and purposes of what I've gleamed from the marketing speak, is burned into the TPM at the factory) is unique? I thought we were trying to get away from identifiable fingerprints? This seems like the most unique one you could get. I'm trying to learn about it, but all google wants to throw up these days is news articles on win11's requirement if it, marketing none-speak about "securing the platform" (which does to a layman, read similar to the other comments cry of lock-in), or dense whitepapers on threat models and cryptographic math.

staticassertion 5y ago
So, first off, the entire point of a session cookie is to uniquely identify you. Like, if you log into a website, it should be you, right? Second, you're close but just a bit off. While the TPM has a secret internally, it wouldn't expose that - it would be used to generate other secrets, or to sign things, basically it's sort of like putting a crypto library into your device so that you can perform cryptographic operations without knowing the secrets involved. But yes, there's a seed that gets soldered into the device itself. I use TPMs to ensure that no one can access our AWS environments from devices other than those we own, for example. I'm not really an expert on this sort of thing, though I do work in security professionally - hopefully I'm not butchering this. There are quite a few experts on the matter who comment on HN though, maybe one of them can speak more authoritatively on this. edit: Actually, I misread maybe - you aren't off. The session cookie is tied to the TPM - either existing within it, or requiring re-validation via the TPM.
- Dylan16807 5y ago
  I don't want most session cookies to know I'm the same person from a previous cookie. And even if they know I'm the same person, I'd prefer they still not know whether the device I just logged in on is the same as a previous device. Separately from that, using the TPM to lock the session cookie to the device sounds useful.
  - staticassertion 5y ago
    I think we should differentiate a TPM backed cookie from, say, a tracking cookie. It isn't like an arbitrary website can track you with the TPM. TPMs aren't exposed to the web by any browser, at least to my knowledge - except through intermediary protocols provided by something like webauthn or an extension (Extended Verification, for example). Again, maybe someone more knowledgeable can explain more - I'm a consumer of TPMs, and I understand the concept, but I'm no expert.
    - Dylan16807 5y ago
      Well you can't secure normal cookies against extraction with a TPM, because you have to extract them to use them. So the question is how a particular protocol works, and whether a site can still identify you after you've deleted your session cookie. As far as I understand it, if you were wantonly using webauthn for all your session cookies, it would be relatively easy for a site to check if you're the same person as before.
      - my123 5y ago
        > because you have to extract them to use them Nope, the thing is that you ask the TPM to sign something with the key/secret, but the TPM will not allow you by design to exfiltrate the secret.
        Dylan16807 5y ago
        Doing that would not be a normal cookie, which is my point.
mjg59 5y ago
No. Every TPM has a factory-supplied unique key called the endorsement key, but every other key on the TPM is randomly generated on the TPM. The keys you actively use /can/ be tied back to the endorsement key, but there's no need for them to be - for most cases, any cryptographic material you generate on the TPM will be indistinguishable from material you generate on the CPU, other than to the local client.
eecc 5y ago
It’s like having a Yubi key soldered into your machine. Each identity you want to protect has its own key (so its’s not necessarily de-anonymizing) with physical access - pin, biometric verification - required for use. It’s potentially very useful, although I 100% expect it to be backdoored by every geopolitical block.

hvdijk 5y ago

> They said it about UEFI - and yet I run Linux on UEFI systems all the time. Not just any UEFI, UEFI with SecureBoot enabled specifically. On SecureBoot-enabled systems, you're booting a Microsoft-signed executable that chainloads Grub, which then loads Linux. This has given Microsoft a power they should not have: the power to refuse to sign future versions of that first executable.

martinflack 5y ago
FWIW, you can setup your machine to boot using your keys rather than Microsoft keys: https://www.dannyvanheumen.nl/post/secure-boot-in-fedora/ https://www.dannyvanheumen.nl/post/secure-boot-in-fedora/
eecc 5y ago
Uhm, but on my Thinkpad I have to add keys to load Linux in trusted mode (installer asks to choose a password to lock these keys in order to establish their legitimacy when rebooting.) Also Ventoy needs to install user-defined keys into UEFI to make it work with Secure Boot. So my assumption is that - at least on Thinkpads - you can add your own user-defined keys; the only Caudine Fork where a Microsoft blessed loader might be involved is the one used by the distro installer. Or am I missing something
- michaelmrose 5y ago
  When this was first discussed in the early 2000s the very legitimate worry was that it would be introduced as optional and gradually become mandatory terminating in machines where the user had as little control over the hardware/software as a game console. There is no reason to believe that this wasn't implemented thus far because of the high ethical standards Microsoft folks have historically adhered to and while we are to believe Microsoft has turned over a new leaf much of the current leadership was involved at the executive level in old bad Microsoft.
vladvasiliu 5y ago
As others have said, this is either FUD or limited to specific systems with broken UEFI implementations. I think the whole "MS-signed Grub" is a way by Ubuntu (and possibly others) to facilitate Linux installation by "non pros". And it's not that bad, I think. I, personally, use Arch Linux and the installer isn't signed with anything. They have a "do your own signing" policy. I had to disable SecureBoot to install it, because I couldn't be bothered to create a new ISO, but then I registered my own keys to the UEFI and boot directly my own signed kernel [0], without using GRUB at all. I did all this on multiple generation HP "enterprise" laptops and desktops and it worked without any issue. And those systems don't come with any sort of Linux support from HP. --- [0] For the curious, this is EFISTUB combined with sbsign, that bundles the kernel image, initrd and CPU microcode in a single EFI binary and signs it. This is then booted directly by the UEFI, and you can even register multiple binaries and have them show up in the UEFI boot selection menu.

rodgerd 5y ago

> Such is HN, though. A great many people who don't know as much about security or have a rational approach to threat modelling, alas.

userbinator 5y ago

The problem is that the TPM holds a secret that even the user cannot access despite being the owner. This is a very significant win and critical to 'zero trust', which is now something the government is telling people to embrace. If the government is really saying the equivalent of "trust us, but not the people you usually trust", that should a huge warning sign. The analogies to 1984 are disturbingly close.

staticassertion 5y ago
> The problem is that the TPM holds a secret that even the user cannot access despite being the owner. Why is this a problem? > If the government is really saying the equivalent of "trust us, but not the people you usually trust", I don't understand what you're talking about here. There is no additional trust necessary.
- michaelmrose 5y ago
  Let's say you don't want users to view foobar.com so you convince Microsoft to configure it's browser not to resolve foobar.com. No problem the users install their own browser. Now we ask Microsoft to limit software that is signed by it effectively granted permission to run some software but not others. The alternatively browser is right out. The user installs his own OS now we ask Dell to only allow it's computers to boot software that implements the same restrictions as Microsoft has agreed to. So the user gets his own computer. Now we simply ask your bank or better yet your ISP not to connect to "insecure" devices that don't follow the standards described. Now you need a substantial unlatched vulnerability to be able to resolve foobar.com At it's root to make a users own device effectively restrict what they are allowed to do you need something difficult to defeat that you control and they do not. At one point a us senator wanted this used to allow music labels to remotely destroy users computers if they believed that you were pirating music and every other restriction described has been implemented or discussed using on user devices belonging to users and most implemented.
  - staticassertion 5y ago
    You can access TPMs on Linux just fine so this entire "but then what if" chain kinda makes no sense. A TPM restricts nothing on its own, it's just a hardware crypto token. I mean sure, if Microsoft decided that it wanted to do all of the things you said, and could convince all of the OEMs to help, and a bunch of services and ISPs or whatever, yes, that would suck. It's a totally fabricated hypothetical that would never play out, but sure.

VMtest 5y ago

Does the TPM or Microsoft's Pluton on the AMD/Intel CPU prevents people to use Linux? I know some Linux distros already supporting enabled Secure Boot edit: sorry I reread your comment that you already mentioned Linux can run with TPM

michaelmrose 5y ago
The point is that the TPM is an essential element of a set of standards called trusted computing that includes secure boot and more. It's not that secure boot nor the TPM in any fashion keeps Linux from inherently working. It's that it enables the OEM to decide what software is allowed to boot on the computer and enforce this. Microsoft typically gives OEMs a substantial break and the OEMs in turn sell most SKUs to 99% windows users and make only a small margin on those devices. A small discount on the cost of windows could make devices disproportionately more profitable and MS might be apt to see a percentage in offering such a discount to help lock out the competition. They have in fact over the years engaged in far more unethical behavior including investing tens of millions in a "partner's" fraudulent lawsuit/pump and dump scheme against various Linux vendors bankrolling an entire list of felonies.